Repository navigation
tests: Pin ubi9/podman bound image to 9.8-1793032728 - #55
cgwalters-bot wants to merge 2 commits into
Conversation
The ubi9/podman 9.8-1793203936 build that now backs :latest on registry.access.redhat.com has no sigstore signature for that registry's :latest (or :9.8) tag; it only carries registry.redhat.io identities plus registry.access.redhat.com :1793203970. CentOS Stream 10's default policy requires sigstoreSigned for registry.access.redhat.com with the default matchRepoDigestOrExact identity, so pulling it by tag on the upgraded guest is rejected and the centos-10 ostree upgrade test fails on every PR. Pin the previous build by digest. The storage check in the logically bound install test looked images up by repository:tag, which a digest reference doesn't have, so look each one up directly. Assisted-by: https://github.com/cgwalters/cgwalters#llms Signed-off-by: Colin Walters <walters@verbum.org>
d684d11 to
7892258
Compare
|
Promoted on the operator's approval as bootc-dev#2606, at head 7892258, which adds the operator's Signed-off-by. Generated-by: https://github.com/cgwalters/#llms |
The digest pinned in the previous commit is the manifest list's, but the install path copies bound images out of host containers-storage with `podman image push`, and the host only holds the per-arch manifest. containers-storage then refuses the copy with "Digest of source image's manifest would not match destination reference". The 9.8-1793032728 tag carries a registry.access.redhat.com signature for that exact identity, so pulling it by tag satisfies the default sigstoreSigned policy and needs no digest. That also lets the logically bound install test go back to matching repository:tag. Assisted-by: https://github.com/cgwalters/cgwalters#llms Signed-off-by: Colin Walters <walters@verbum.org>
|
Added the operator's Generated-by: https://github.com/cgwalters/#llms |
ee5ee90 to
03b72b2
Compare
cgwalters-bot
added
the
needs-human
|
Holding this with Generated-by: https://github.com/cgwalters/#llms |
|
Closing: this branch merged upstream as bootc-dev#2606 on 31 Oct, so nothing is left to do here. Generated-by: https://github.com/cgwalters/#llms |
test-upgrade (centos-10, ostree)has failed on every PR since about 2026-10-29 with:The new ubi9/podman build 9.8-1793203936 (
sha256:eabafb0a…) is signed, but its sigstore attachments (sha256-eabafb0a….sig) only carry identities forregistry.redhat.io/ubi9/podman:{latest,9.8,9.8-1793203936,1793203970}andregistry.access.redhat.com/ubi9/podman:1793203970. The previous build 9.8-1793032728 (sha256:2cfaa836…) also hadregistry.access.redhat.com/ubi9/podman:{latest,9.8,9.8-1793032728}. CentOS Stream 10's/usr/share/containers/policy.jsonrequiressigstoreSigned(Red Hat release3 key + Rekor) for registry.access.redhat.com with the defaultmatchRepoDigestOrExactidentity, so pulling:latestby tag on the upgraded guest is rejected. Fedora's policy and the composefs variants (which drop bound images) aren't affected.Reproduced with skopeo and the stock CentOS 10 policy/keys:
:latestis rejected;9.8-1793032728by tag and both builds by digest are accepted.This pins the previous build by its
9.8-1793032728tag everywhere the bound image is referenced. That tag has a registry.access.redhat.com signature for its exact identity, so the default policy accepts it. An earlier revision pinned the manifest-list digest, but the install path copies bound images out of host containers-storage withpodman image push, and that fails with "Digest of source image's manifest would not match destination reference" because the host only stores the per-arch manifest. Revert once Red Hat republishes the missing registry.access.redhat.com tag signatures.Generated-by: https://github.com/cgwalters/#llms